Home

WindowsXP

Encrypting File System (EFS)

• By using file encryption on NTFS disks you will prevent other users from using the encrypted files. Even if they have some other permissions for using the files, the access is denied for other users who work on your computer. Setup and using of EFS is not difficult, you just have to set the encryption attribute and you can work with the files as with other unencrypted files. The EFS is mostly used for sensitive data on portable computers for the case of a theft, it is necessary in networks and on computers where a higher security is required, but also at home you can use it to ensure more privacy. Higher security also brings lesser problems with possible wrong permissions.

• Principle - Upon encrypting data, the EFS service automatically creates user´s EFS certificate that ties to a private and a public key of the user. Each file or folder is encrypted according to its unique encryption key (FEK - File Encryption Key) which is protected by the public key of the user who have encrypted the data. Data are protected by symmetric encryption that is much faster than the asymmetric used only for the protection of the encryption key (FEK). The access to the data is only available after the user who have encrypted the data logs on, to users permitted to share the encrypted files (Windows XP) and to recovery agents. To decrypt the FEK key you have to use the private key of the EFS certificate or EFS recovery agent.

Activating and deactivating file encryption

• 1. Choose an object that you want to set up the encryption to (file, folder or several objects) 

• Open the local menu of the marked objects (by clicking the right mouse button) and choose Properties. 

On General choose Advanced..

 (Windows 2000 vs XP)

• Check or un-check Encrypt contents to secure data. You can also use the Cipher command to encrypt or decrypt files.

• You will be asked if the encryption should be used only on file, on the whole folder or on files in the folder or in its subfolders. Encryption of folder is recommended.

• In Windows XP, there is an extra button - Details - in attributes. Here you can: a.) specify more users who will be allowed to access the encrypted file. b.) display users and  recovery agents (Data Recovery Agent) authorized to decrypt the file (in Windows 2000 you must use efsinfo).

• 2. Cipher command

• 3. Activate encryption menu in the local menu (Q241121)

Warning

• Using encrypting can be dangerous if incorrectly used.

• Certificates are always for one user and one (current) OS installation. If you reinstall the OS, remove or incorrectly use the certificate, if the user´s profile gets damaged, if you reset the password or there occurs another situation that leads to problems with decrypting, the data are usually irrecoverably lost.

• By resetting the user´s password the access to the encrypted files is denied and the recovery is then only possible by using the recovery agent!

• Experiments - incorrect setup and experimenting with encryptions and with certificates can lead to data loss. Backup the encrypted data and certificates for recovery agents (or users).

Optimal procedure of encryption setup 

• 1. - Create and set up the recovery agent

• 2. - Backup the certificate of the recovery agent and export the private key apart from the computer

• 3. - Set up encryption

• 4. - Backup certificate and user´s private key.

Notes

• Using encryptions: 1. Only NTFS, it cannot be used on the FAT file system. 2. It cannot be used in combination with compression (you have to decide between compression and encryption). 3. It cannot be used on Windows XP Home Edition (only for Windows 2000 and Windows XP Professional.) 4. Roaming profile files and files in the %Systemroot% folder cannot be encrypted.

• Encryption Standard: 1.  Data Encryption Standard (DESX) algorithm (56bit). 2. In USA, there is available the Enhanced CryptoPAK pack extending the encrypting functions by 128bit key. 3. In Windows XP you can use the TripleDES algorithm (Group policy - Computer Configuration\Windows Settings\Security Settings\Local policy\Security Options\System cryptography: Use FIPS compliant algorithms to encrypt, to calculate the hash value and to sign.

• Network transfer - File encryption is only used to secure data on local computer. Data are not protected when transferring through network. To encrypt the data transfer we recommend that you use IPSec or WebDAV web folders.

• Backup - Files and folders can be backed up in the encrypted form by using the command of the ntbackup program. For reading and recovering on target computer, it is required that the certificate for users or recovery agents are stored on a special media and on a safe place. Using backup is also convenient way for transferring data between computers in case you do not have a portable disk with NTFS or network.

• Reasons for recovery agents - Data can be confidential, but usually the content relates to a company and so it is also necessary to allow other user to access it. The most frequent reason is absence of the authorized person in the house (holiday, en of employment, illness, death,..).

• Old and new certificates - Files are encrypted by a certain certificate, not by a user. Before you delete the old certificate you have to make sure whether you really decrypted all files relating to this certificate.

• Recognition of encrypted files - Encryption is being defined as transparent: the authorized user cannot recognize at first sight whether a file is encrypted or not. The unauthorized user will be displayed an "access denied" message. You can distinguish the files by: 1. setting up different color for encrypted and compressed files. 2. by ticking or unpicking encryption in file properties. 3. the Cipher command. 4. the EFSInfo command.

• You need a permission for the encryption- e. g. for users under Windows XP with limited access (Restricted User - Users Group), the encryption cannot be used in some directories - the Users group does not have appropriate NTFS permission. To be allowed to encrypt you must have the right to record file or folder attributes. New files created by just logged on user can be encrypted.

Recommendation

• Setting up different color for compressed files in Explorer - When viewing disks the displayed files will be green. This you can set up in Folder Options - View - Show encrypted or compressed NTFS files in color. (For Windows XP; in Windows 2000 only compressed files have another color - a picture you will find in the article: Compression).

• Using encryption on whole folders - The encryption cannot be set for whole volumes (disks). It can be set for directories and files. If you choose to encrypt folders, there will be a dialog displayed which asks whether you want to use the encryption also for subfolders and files. I recommend that you only use it for folders. If you want to protect documents, I recommend that you encrypt  My Documents or another directory used for your documents in your user profile.

• Encryption of the %Temp% directory and the directory for print queue - this relates to the previous recommendation - encryption of whole folders. When opening or printing, there are created temporary files in unencrypted form. 

• Manipulation - upon having appropriate permission you can move or copy the files but you still cannot open them. If the owner who have set up the encryption copies the files to a volume with the FAT file system or to diskette, the file will be automatically moved in deciphered form.

• More recovery agents - It is recommended that you set two or more recovery agents in order to heighten the possibility of recovery.

• In case of use in company consider the installation of Certificate Services - Certificates for EFS are not signed by the EFS service, but by CA. Certificate administration is easier, more effective and provides possibility of issuing other types of certificates.

Export the private key apart from the computer

• Leaving the private key of the recovery agent in computer is not too safe. If a user finds out the name and the password of the user - owner of the certificate of recovery agent - he/she can access all encrypted files to which this recovery agent relates. If there is no need to access and recover the encrypted file, it is recommended that you export the private key of the recovery certificate apart from your computer. The private key is removed after the export. Without it the recovery of encrypted files cannot be done. Till you import the key back, nobody will be able to abuse the account of the recovery agent.

• Log on under the recovery agent's account and follow instructions in the Certificate export article.

Recovery Agents

• The user who owns the certificate for recovery of EFS file is the agent. The default setup differ:

• Creating agent: Log on under the user account that you want to use to file recovery. In the command line write cipher /r:name - in the current directory, after entering and confirming the password, there will be a certificate created - name.cer (Certificate X509) and name.pfx (Personal Information Exchange - standard PKCS #12)

• In Certificate Manager (certmgr.msc) open the Personal\Certificates folder and right-click to choose All Tasks -  Import.. 

Group policy (Recovery policy)

• Location: 

Local Computer Policy\Computer Configuration\Windows Settings\Security Settings

\Public Key Policies\Encrypting File System

• The default setup in Windows XP in group is no recovery agent. Data can be encrypted, but in case there occur some problems with the user´s certificate the data cannot be recovered to decrypted form.

• Use the right mouse button to add recovery agent, choose "Add Data Recovery Agent" and  import the recovery agent certificate (e. g. name.cer)

• To disable EFS choose "Properties" and unpick "Allow to user encrypt files using Encryption File System (EFS)" (Windows XP).

• Location2: 

Computer Configuration \ Administrative Templates \ System \ 

Group Policy - EFS recovery policy processing

Computer Configuration \ Administrative Templates \ System \

Do not automatically encrypt files moved to encrypted folders

Three possible options of Recovery Policy (RP) (Windows XP)

• 1. The policy is used - Agent´s or recovery agent´s certificates are set and displayed. Available options: 1. Add Data Recovery Agents.. 2. Delete Policy

• Together with the public key of the encrypting user, there is also information about the recovery agent´s public key recorded to each file.

• 2. No policy defined - in EFS this text is displayed: There is no policy defined. In Windows 2000, there is no text displayed.

• Available options for WXP: 1. Add Data Recovery Agents.. 2. Do Not Require Data Recovery Agents

• Available options for W2K: 1. Add.. 2.Initialize Empty Policy

• In Windows 2000, you cannot use EFS without the recovery agent (in WXP it is possible). 

• Not defined policy enable activation of other local policies on stations. 

• 3. No recovery agent (Empty policy) - in EFS this text is displayed: There are no items to show in this view. In Windows 2000, there is no item and only the headings of the columns for certificates are displayed.

• Available options for  WXP: 1. Add Data Recovery Agents.. 2. Delete Policy

• Available options for  W2K: 1. Add.. 2. Delete Policy

• Empty policy disable using of EFS on all computer in domain.

• OK - The encryption can be used on files and folders.

• A. When attempting to encrypt, this message is displayed: There is no valid encryption recovery policy configured for this system (W2K Server). Encryption cannot be used.

• OKA - Encryption can be used. The agent registered in Local Security Settings becomes the recovery agent of the used station.

• OKB - Encryption can be used, but without the recovery agent.

• Local policy is defined for station (Local Security Settings - secpol.msc), Domain policy is defined for domain environment.

Domain environment

• The Administrator account is set for the whole domain as default recovery agent.

• It is recommended that you use 2 or more recovery agents and export the private key to a quality backup medium and store in a safe place (vault).

• In case you want to use encrypting on more computers, you have to set up roaming profiles or always import keys to currently used computer.

• On computer on which you want to use encrypting on the domain level, there must be Delegating enabled in the Active Directory (Active Directory Users and Computers - Computers - by clicking the right mouse button on the computer account open "Properties")

• Certificates are usually gained by help of the Microsoft Certificate Services

Cipher command

• Enables to encrypt or decrypt files from the command line. Besides these basic tasks it also provides information about the state of the encryption in the current directory (more info - cipher /?)

Syntax: 

cipher [/e| /d] [/s:dir] [/a][/i] [/f] [/q] [/h] /k [/u /n] [path [...]] [/r:Path]

• /e - encrypts specified folders. When you create a file in this directory, it will be automatically encrypted.

• /d - decrypts specified folders. Other files created in the directory will not be encrypted.

• /s:dir - carries out the command in specified folder in all its subfolders (does not work with files)

• /a - carries out the command with all files and folders

• /i - in case there occurs some errors, they are ignored and encrypting continues

• /f - this will enforce encryption or decryption for all objects. The files that have already been encrypted or decrypted, will not be implicitly processed.

• /q - only tells basic information

• /h - displays hidden and system files - implicitly, these files are not being encrypted.

• /k - creates a new certificates for the user who started the cipher command (not combined with other switches). If there exist CA in the network, the self-signed certificates are substituted by the CA certificates. Q295680

• /u - updates the encryption key of the logged on user or the key of the recovery agent

• /u /n - finds all encrypted files, no changes on files are made.

• [path [...]] (pathname) - determines mask, file or folder

• /r:Path - Generates new certificate and recovery agent´s private key and writes them into given directory. (if you want to use the current directory you do no have to specify the path).

Examples:

• cipher /e /a - encrypts all files and folders of the current directory (not the files in folders)

• Q295680 - Using the Cipher.exe Utility to Migrate Self-Signed Certificates to Certification Authority- Issued Certificates

• Q298009 - Cipher.exe Security Tool for the Encrypting File System (Download new version - include with Windows 2000 SP3)

EFSInfo

• This is an important tool giving information about encrypting under Windows 2000. It enables to find user who encrypted the file and the recovery agent. In Windows XP, this information can be found easily, but for fast search of information about more files this tool is still good.

• Tip:  1. Copy the efsinfo file into the %systemroot% directory.  2. Use syntax efsinfo /u /r

• Q243026 - Using Efsinfo.exe to Determine Information About Encrypted Files

• Q264178 - Description of the Windows 2000 Resource Kit Security Tools

Error messages and troubleshooting

• Access is denied - 1. The file is encrypted by another user. 2. You do not have the appropriate NTFS permission. 3. On network disks, the server account must be allowed for delegating. 4. Your profile, certificate or private key is not available.

• ..losing its encryption - in case you move or copy from NTFS to FAT, the encryption will be canceled. When doing it in Explorer, a warning message is displayed.

• Recovery policy configured for this system contains invalid recovery certificate - Check the validity and if the right certificate is used.

• 'Filename' is encrypted. If made available offline, the offline copy will not be encrypted.  - (Q254156 - Encrypted Files Made Available Offline Are Not Encrypted on the Client)

• When attempting to encrypt, this message is displayed: This machine is disabled for file encryption - 1. In this register - HKLM \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ EFS - change the EFSConfiguration value to 0 or remove it (1 means disabling EFS) -  It can require restart to take effect - 2. Use group policy (Allow to user encrypt files using Encryption File System (EFS))

• Cannot open the xxxx file. Make sure a disk is in the drive you specified. - in my case, it was an attempt to access an encrypted file from another user on a network disk

• Using of Smardcards - for EFS this is not supported.

• Forgotten password - 1. Data recovery by help of recovery agents (if existed at the time of encrypting the files). 2. Use Password reset disk (this safety diskette must exist before the user loses or forget the password). 

An error occurred applying attributes to the file: xxxxx 

• There is no valid encryption recovery policy for this system - Q222022

• The required encryption driver is not loaded for this system - Q288579

• The process cannot access the file because it is being used by another process - The file is opened or used by some program.

• The profile for the user is a temporary profile - using of compulsory user profile. User with this profile cannot use encrypting.

Related Links

Web links»Windows»EFS

Print Print article | Recommend Send link